Blockchains Building With Kyber and Dilithium: A 2026 Post-Quantum Cryptography Roundup

Blockchains Building With Kyber and Dilithium: A 2026 Post-Quantum Cryptography Roundup

NIST finalized its first post-quantum cryptography standards in August 2024: FIPS 203 (ML-KEM, built on CRYSTALS-Kyber), FIPS 204 (ML-DSA, built on CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, built on SPHINCS+), with FIPS 206 for Falcon still in development (NIST, 2024 (https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards)). Since then, a handful of blockchain networks have started publicly testing or shipping lattice-based and hash-based signatures on live chains. This roundup looks at who is actually doing what, based on public technical briefs and roadmaps, not marketing claims.

Quantum risk to blockchains is specific: most chains still sign transactions with ECDSA or Ed25519, both of which rely on elliptic-curve math that Shor's algorithm could eventually break. Once a public key has been exposed on-chain, a sufficiently powerful quantum computer could, in theory, derive the private key behind it. For a deeper explainer on why this matters for blockchain generally, see our earlier piece on what post-quantum cryptography means for blockchain. This post goes narrower: which specific networks are building with Kyber, Dilithium, Falcon, or their NIST-standardized successors, and where each one actually stands today.

The Standards Everyone Is Building Against

Before naming projects, it helps to know what they're building with. NIST's post-quantum program narrowed an eight-year, 82-algorithm review down to a handful of finalists (NIST/CSRC, 2024 (https://csrc.nist.gov/news/2024/postquantum-cryptography-fips-approved)):

• FIPS 203, ML-KEM (from CRYSTALS-Kyber): a lattice-based key encapsulation mechanism for establishing shared secrets, meant to replace RSA and elliptic-curve Diffie-Hellman for key exchange.
• FIPS 204, ML-DSA (from CRYSTALS-Dilithium): the primary lattice-based digital signature standard, intended to replace ECDSA and RSA signatures in most applications.
• FIPS 205, SLH-DSA (from SPHINCS+): a hash-based signature scheme kept as a conservative backup in case lattice assumptions are ever weakened.
• FIPS 206, FN-DSA (from Falcon): a compact lattice-based signature standard still in development as of 2026, valued for its smaller signature size, which matters for bandwidth-constrained systems like blockchains.

Kyber and Dilithium in particular have become the default reference pair for teams migrating away from elliptic-curve cryptography, since ML-KEM and ML-DSA cover the two core jobs, key exchange and signing, that a blockchain needs. Falcon has drawn separate interest because its signatures are smaller than Dilithium's, which matters when every validator has to broadcast and store them.

Algorand: Falcon Signatures Already on Mainnet

Algorand has arguably moved furthest of any major public chain. It introduced State Proofs in 2022, post-quantum compact certificates that use Falcon signatures to attest to the last 256 block headers, protecting the chain's historical record against a future quantum attack (Algorand Foundation (https://algorand.co/technology/post-quantum)). In 2025, Algorand went further and executed one of the first quantum-resistant transactions on a live public mainnet using Falcon signatures, and in November 2025 it introduced Falcon-based accounts backed by LogicSignatures. The Algorand Foundation's June 2026 roadmap targets broad quantum resilience by the end of 2027, including native Falcon-1024 accounts with SDK support, post-quantum multisignature for institutions, and research into a post-quantum verifiable random function led by Chief Scientific Officer Chris Peikert.

Ethereum: A Multi-Year Lattice and Hash-Based Rebuild

Ethereum's approach is broader in scope because it has to migrate several distinct cryptographic layers, not just one signature scheme. Under the Lean Ethereum initiative, the Ethereum Foundation is targeting four areas: consensus-layer BLS signatures, KZG data-availability commitments, ECDSA account signatures, and application-layer ZK proofs (Ethereum Foundation (https://ethereum.org/roadmap/security/quantum-resistance/)). For validator signatures specifically, Ethereum is prototyping leanXMSS, a hash-based scheme, paired with a minimal zkVM called leanVM that compresses the larger post-quantum signatures by roughly 250x to keep aggregation efficient. For everyday account signatures, the plan leans on account abstraction (EIP-8141) so individual wallets can migrate to post-quantum schemes on their own timeline rather than waiting for a single network-wide cutover. The Ethereum Foundation formed a dedicated Post-Quantum Security team in January 2026, led by Thomas Coratger, and by April 2026 more than 10 client teams, including Lighthouse, Grandine, and Zeam, were running weekly post-quantum interoperability devnets. Ethereum's own roadmap explicitly builds on the NIST ML-KEM and ML-DSA standards, which trace back to Kyber and Dilithium.

Hedera: A Sequenced, Hybrid Migration Path

Hedera's public engineering discussion of its post-quantum plan is unusually specific about sequencing. As Hedera co-founder Dr. Leemon Baird explained in a 2026 DevDay fireside chat, hashgraph's cryptography touches four areas: hashing, encryption, key agreement, and digital signatures, and two of those, SHA-384 hashing and AES-256 encryption, are already considered quantum-safe by current expert consensus (Hedera DevDay 2026 (https://www.youtube.com/watch?v=r-Fu-kB3F4g)). The remaining gap is key agreement and signatures, both currently built on Ed25519 and ECDSA. Hedera's published migration plan moves in stages: post-quantum TLS for node-to-node traffic first, then for client connections, then a hybrid Ed25519-plus-Falcon signature for consensus event signing once the FIPS 206 draft is available, and finally a new post-quantum key type for user accounts through the Hedera API, targeted for 2027 (Hedera (https://hedera.com/blog/post-quantum-cryptography-and-blockchain/)). If the Falcon standard is delayed, Hedera's plan explicitly falls back to Dilithium (ML-DSA) instead, accepting larger signatures in exchange for staying on schedule. Separately, hardware partner SEALSQ has been integrating its QS7001 post-quantum secure chip, built on Kyber and Dilithium, with Hedera's ecosystem since a December 2024 partnership announcement (SEALSQ (https://www.sealsq.com/investors/news-releases/sealsqs-qs7001-secure-chip-to-quantum-proof-blockchain-platforms)).

QANplatform and QRL: Purpose-Built Quantum-Resistant Chains

A smaller set of chains were designed around post-quantum cryptography from day one rather than retrofitting it. QANplatform runs an EVM-compatible Layer-1 that pairs lattice-based Dilithium signatures with a hybrid public and permissioned architecture, letting developers deploy Solidity, Python, or Go contracts without rewriting them for a new virtual machine. The project has reported enterprise pilot activity, including a European Union ministry pilot in May 2025 and a $15 million raise from MBK Holding in April 2024 (Blockmanity, 2025 (https://blockmanity.com/news/5-quantum-resistant-blockchain-projects-worth-watching-in-2026/)). Quantum Resistant Ledger (QRL), meanwhile, launched in 2018 as one of the earliest post-quantum blockchains, using XMSS, a hash-based signature scheme, from its genesis block, and has continued extending that approach toward SPHINCS+ for smart contract use cases. These are worthwhile case studies for any team weighing a similar architectural bet; our own breakdown of what it takes to secure agentic systems against quantum-era threats covers some of the same design tension between signature size, security margin, and throughput, see securing agentic systems in the post-quantum era.

Cardano: A Bottom-Up Research Framework

Cardano's approach is currently framed as a research program rather than a shipped feature. Its June 2026 Cardano Vision 2026 roadmap, developed with a global academic consortium, names a bottom-up post-quantum cryptography framework as one of its core pillars, describing it as designed to preemptively swap out core consensus primitives for quantum-secure alternatives (Cardano, 2026 (https://cardano.org/news/2026-06-19-cardano-vision-2026/)). As of that announcement, Cardano had not published specific algorithm choices or a signature migration timeline, which puts it earlier in the public disclosure process than Algorand, Ethereum, or Hedera.

Where Autheo Fits: Standards-Based From the Start

Autheo did not retrofit post-quantum cryptography onto an existing signature scheme. It designed its security model around NIST's Kyber, Dilithium, and Falcon families from the outset, positioning post-quantum resistance as a foundational property of the network rather than a future migration project, though it is not yet threaded into the live system. That matters because, as the roundup above shows, most established chains are in the middle of a multi-year, multi-stage retrofit: Ethereum is rebuilding four separate cryptographic layers, Hedera is sequencing a four-stage hybrid rollout, and even Algorand, which has moved the fastest, is still building out native account support and post-quantum multisignature tooling through 2027.

Autheo's validator and identity architecture is designed around this same NIST standards family from the ground up, which is a meaningfully different starting position than adding post-quantum signatures to a chain that has been running on ECDSA or Ed25519 for years. For a full breakdown of how this fits into Autheo's broader security architecture, see our post-quantum readiness checklist for L1/L2 builders, and for what this means in plain terms if you're not a cryptography specialist, see what post-quantum security means for ordinary people. Autheo's identity layer, TheoID, is designed to build on this same post-quantum foundation as it rolls out over the coming months alongside the network's other non-staking utilities.

It's worth being precise here: staking and transaction fees are live on Autheo mainnet today. TheoID, along with compute (DCC), storage (ABW34), and post-quantum cryptography, are rolling out over the coming months as part of the network's phased release. The post-quantum cryptography underpinning these layers, Kyber, Dilithium, and Falcon per NIST standards, is a design choice baked into the protocol rather than a bolt-on patch, though it is not yet threaded into the live system.

Why the Signature Scheme You Pick Actually Matters

The projects above aren't all solving the same problem in the same way, and the differences carry real trade-offs. Dilithium (ML-DSA) signatures range from roughly 2,420 to 4,627 bytes depending on security level, while Falcon signatures are meaningfully smaller, around 1,280 bytes at the highest security tier, which is part of why bandwidth-sensitive networks like Hedera are trying to hold out for a finalized Falcon standard rather than defaulting straight to Dilithium (Kaspersky, 2024 (https://www.kaspersky.com/blog/post-quantum-cryptography-standards/52066/); Hedera (https://hedera.com/blog/post-quantum-cryptography-and-blockchain/)). Hash-based schemes like SPHINCS+ and XMSS trade signature size for a different, more conservative security assumption. There's no single right answer yet, which is exactly why a growing number of teams are hedging with hybrid classical-plus-post-quantum signatures during the transition period, as Hedera's own migration plan does.

Standards Bodies and Hardware Are Moving Too

Blockchain-native adoption is only part of the picture. NIST's PQC Standardization Project itself has already gone through multiple rounds of refinement since the initial FIPS 203/204/205 publication in August 2024, including domain-separation fixes intended to prevent key misuse across parameter sets (PQShield, 2024 (https://pqshield.com/new-nist-approved-pqc-algorithms/)). On the hardware side, semiconductor firm SEALSQ has been benchmarking Kyber and Dilithium performance on dedicated secure chips aimed at blockchain, AI, and IoT use cases, demonstrating results publicly at the Davos 2025 Quantum Security Roundtable alongside Microsoft and the Cybersecurity Tech Accord. That combination, protocol-level adoption plus purpose-built secure hardware, is a signal that the shift toward Kyber- and Dilithium-class cryptography is moving from academic exercise to deployed infrastructure across the stack, not just inside any single blockchain's codebase.

Key Takeaways

• NIST finalized ML-KEM (from Kyber), ML-DSA (from Dilithium), and SLH-DSA (from SPHINCS+) as official post-quantum standards in August 2024, with FN-DSA (from Falcon) still in draft as of 2026.
• Algorand has gone furthest among major public chains, running Falcon-signed State Proofs since 2022 and executing quantum-resistant mainnet transactions in 2025.
• Ethereum's Lean Ethereum roadmap is rebuilding four separate cryptographic layers, including a hash-based leanXMSS scheme for validator signatures, with core infrastructure targeted for around 2029.
• Hedera's sequenced migration plan defaults to a hybrid Ed25519-plus-Falcon signature and falls back to Dilithium if the Falcon standard is delayed.
• Purpose-built chains like QANplatform (Dilithium) and QRL (XMSS) were designed around post-quantum signatures from genesis rather than retrofitting them.
• Autheo's security architecture is designed around Kyber, Dilithium, and Falcon per NIST standards from the outset, with staking and fees live today and TheoID, post-quantum cryptography, and other utilities rolling out over the coming months.

Most of the crypto industry is still mid-migration on post-quantum cryptography, patching lattice-based and hash-based signatures onto networks that were designed around elliptic-curve math a decade or more ago. Autheo skipped that step. To see how this standards-first approach fits into the rest of the network's design, read our complete guide to what Autheo is, or visit autheo.com to learn more about building on post-quantum-ready infrastructure.